iTnews

Sysadmin creates tool to scour web for hacked data

By Darren Pauli, SC Magazine on Nov 26, 2012 1:10PM
Sysadmin creates tool to scour web for hacked data

Track leaky staff, hackers.

A Wellington system administrator has developed a tool to identify corporate secrets, hacked data and even stolen credit cards as they emerge on social networks and online clipboards.

Users could set the OSINT OPSEC (Open Source Intelligence / Operational Security) Tool to monitor for keywords, allowing, for example, an organisation to be alerted if a hacking group dumped its sensitive data to clipboard site Pastebin.

Or it could scour Stack Exchange for intellectual property code snippets, use Twitter to track the whereabouts of politicians in warzones, or check Reddit, Facebook and Wordpress to avert potential PR disasters. 

Hyprwired

Blackhats, too, could benefit from the OSINT OPSEC Tool. However author Brendan 'Hyprwired' Jamieson, 21, said it was made to assist users with defence and operational awareness.

"Right now, a whole lot of people are leaking a whole lot of information online," Jamieson told Kiwicon 6 delegates. "Here we have a full US passport, all the serials, date of birth, names, etcetera is all there."

"In 2009, a congressman tweeted 'just landed in Baghdad' and 'moved into green zone by helicopter just over the palace heading to the US embassy' - and if someone was watching this, it could have serious consequences."

Kiwicon 6 coverage

He found staff tweets leaking news of then-incomplete corporate mergers and intellectual property published on public forums.

The tool GUI

It could also geo-locate tweets using Google Maps to assist with OSINT investigations.

Existing services like Google Alerts and API (application programmable interface) search tools were insufficient because they were slow or could not search for keywords on the spread of social media.

Jamieson built the Python tool -- and a new love of the language -- in less than 12 weeks, complete with a shiny GUI and point-and-click functionality.

Critically, it was released as open source via GitHub so users search requests remained hidden.

The OSINT OPSEC Tool plugged into an API to quickly search through data on Twitter, Facebook and Wordpress.

But it had to download full posts to scrape Pastebin. When it rummaged through old posts, the repeat downloads resulted in a momentary block by the site. This could be solved by changing IP addresses via another daemon on a separate site.

"The real key to maintain good OPSEC is to STFU," Jamieson said.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:
facebook kiwicon kiwicon 6 opsec osint pastebin python reddit security social media stack exchange twitter wordpress

Partner Content

MSI shows first laptops with Wi-Fi 6E, Nvidia RTX 30 graphics
Partner Content MSI shows first laptops with Wi-Fi 6E, Nvidia RTX 30 graphics
MSI launches innovative new laptops
Partner Content MSI launches innovative new laptops
Improving returns from SD-WAN spending
Sponsored Content Improving returns from SD-WAN spending
NCS expands into Australia in partnership with Optus Enterprise
Sponsored Content NCS expands into Australia in partnership with Optus Enterprise

Sponsored Whitepapers

The risky business of open source
The risky business of open source
Ensure your e-signatures are legally binding
Ensure your e-signatures are legally binding
Mitigating open source risk in your organisation
Mitigating open source risk in your organisation
How to choose a WAF that's right for you
How to choose a WAF that's right for you
The global telco 5G cloud gaming opportunity
The global telco 5G cloud gaming opportunity

Events

  • On-Demand Webinar: How Poly and Microsoft are Embracing Future Work Environments
By Darren Pauli, SC Magazine
Nov 26 2012
1:10PM
0 Comments

Related Articles

  • Free tool finds hacked data, stolen cards
  • Thailand takes legal action against Facebook, Twitter over content
  • Twitter names famed hacker 'Mudge' as head of security
  • Twitter's security fell short before hack targeting celebrities
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

Telstra blasts plan to 'set aside' mobile spectrum for Optus and TPG, but not it

Telstra blasts plan to 'set aside' mobile spectrum for Optus and TPG, but not it

Accellion hack behind Reserve Bank of NZ data breach

Accellion hack behind Reserve Bank of NZ data breach

Google unravels state-of-art Android and Windows exploit chains

Google unravels state-of-art Android and Windows exploit chains

Tyro halts trading following week-long outage

Tyro halts trading following week-long outage

You must be a registered member of iTnews to post a comment.
Log In | Register
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.